Your quarterly access review is complete. 847 users certified across 23 applications. IT revoked 127 inappropriate access grants. You exported the evidence package for your SOX auditor.

Now you need a checklist. What items do you need to confirm before you say "our access review is done"?

Most access review checklists miss the 10% that actually matters. This guide covers the comprehensive checklist of what you need to verify.

What is an access review checklist?

An access review checklist is a list of items that need to be verified or completed before an access review is considered finished. It ensures nothing is forgotten and serves as a sign-off document.

The basic access review checklist

Every access review needs to verify:

• Coverage: Did we review all users? All systems? All access types?
• Completeness: Did we get a certification from every required certifier?
• Accuracy: Is the data we reviewed accurate and current?
• Remediation: Did we identify all inappropriate access? Was it removed?
• Documentation: Do we have audit evidence of the entire process?

The detailed access review checklist

Phase 1: Planning and Scope

Before you start the access review:

• [ ] Define the scope (users, systems, access types)
• [ ] Identify the systems to review (include all systems with user access)
• [ ] Identify certifiers (managers, system owners, etc.)
• [ ] Set a timeline (review start date, deadline for certifications, remediation deadline)
• [ ] Define what access is "inappropriate" (your removal criteria)
• [ ] Assign review ownership (who owns the overall process)
• [ ] Communicate the review to stakeholders

Phase 2: Data Collection

Collect the access data you're reviewing:

• [ ] Extract user access from every system in scope
• [ ] Normalize the data into a standard format
• [ ] Verify data accuracy (spot-check a few records against the live system)
• [ ] Exclude any users or access that's pre-approved for exclusion
• [ ] Document what systems were reviewed and the date of data extraction
• [ ] Document any data quality issues or gaps

Phase 3: Certifier Assignment and Communication

Assign users to certifiers and send certification requests:

• [ ] Assign each user to the appropriate certifier (usually their manager)
• [ ] Document the assignment logic
• [ ] Send certification requests with clear instructions
• [ ] Include context on why each user needs access (job role, project, etc.)
• [ ] Document when the request was sent

Phase 4: Certification

Certifiers review and approve (or reject) access:

• [ ] Certifiers review assigned users and access
• [ ] Certifiers certify (approve) or reject each access
• [ ] Document all certifier responses (approvals and rejections)
• [ ] Track non-responsive certifiers
• [ ] Send reminders to certifiers who haven't responded
• [ ] Escalate late certifications to managers
• [ ] Document certification completion date and percentage completed

Phase 5: Review of Certification Results

Analyze what certifiers approved/rejected:

• [ ] Identify all rejected access (access that was marked inappropriate)
• [ ] Identify any users with incomplete certifications (no certifier response)
• [ ] Identify any conflicting certifications (different certifiers gave different answers)
• [ ] Challenge any unusual results (100% approvals without review is suspicious)
• [ ] Flag any potentially-inappropriate access that wasn't rejected

Phase 6: Remediation Planning

Plan how to address inappropriate access:

• [ ] Create a list of all access to be removed
• [ ] Prioritize removals (high-risk first)
• [ ] Assign remediation tasks to system owners
• [ ] Set remediation deadlines
• [ ] Document the remediation plan

Phase 7: Remediation Execution

System owners remove the identified inappropriate access:

• [ ] System owners remove assigned access
• [ ] Document what was removed and when
• [ ] Track remediation completion
• [ ] Follow up on overdue remediations

Phase 8: Remediation Verification (This is the 10% everyone forgets)

Most organizations skip this step. Don't.

After access is supposed to be removed, verify it actually is:

• [ ] Re-export user access from each system after remediation
• [ ] Verify that each "removed" access is actually gone
• [ ] Investigate any access that should be gone but isn't
• [ ] Document proof that remediation was verified
• [ ] Create before/after evidence (access existed, now it doesn't)

This step is critical. Auditors specifically check for it. "We removed the access" is not the same as "we verified the access was actually removed."

Phase 9: Documentation and Sign-off

Create the final documentation:

• [ ] Prepare the access review report (summary of findings, remediation, evidence)
• [ ] Get sign-off from the review owner (usually the CISO or CIO)
• [ ] Get approval from leadership (executives, board if required)
• [ ] Archive all evidence (certifications, rejections, remediation records)
• [ ] Document the review completion date

The 10% everyone forgets

Here are the items most organizations miss:

1. Remediation Verification

After IT marks a removal as "complete," verify it actually is. Re-export user access and confirm it's gone. This is what auditors specifically test. "Did you verify that revoked access was actually removed?"

2. Spot-checking Data Accuracy

Before sending the data for certification, spot-check a few records. Does the data match what's actually in the system? If your data is stale or wrong, the whole certification is useless.

3. Assignment Logic Documentation

Document why each user was assigned to their certifier. "Manager reviews their directs" vs. "system owner reviews access." When auditors ask why Jane reviewed Bob, you need to explain why that was appropriate.

4. Conflicting Certifications

If two different certifiers give different answers for the same access, flag it. You might have overlapping access or unclear ownership. Resolve it before you proceed.

5. Unusual Certification Patterns

If every user was approved with zero rejections, something is wrong. Either your access is perfect (unlikely) or certifiers aren't actually reviewing. Spot-check and validate.

6. Non-Responsive Certifiers

Track who didn't respond. A certification that's "assumed approved" because no one responded is weak audit evidence. Get actual approvals.

Summary

Use this checklist to ensure your access review covers all phases and doesn't miss the critical verification steps. Most failures happen when organizations skip Phase 8 (remediation verification) or rely on incomplete certifications from non-responsive managers. Make sure you check every box.